8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26022

CVE-2026-26022: Gogs: Stored XSS via data URI in issue comments

Summary

A Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links.

Details

The vulnerability is located in internal/markup/sanitizer.go. The application uses the bluemonday HTML sanitizer but explicitly weakens the security policy by allowing the data URL scheme:

// internal/markup/sanitizer.go
func NewSanitizer() {
    sanitizer.init.Do(func() {
        // ...
        // Data URLs
        sanitizer.policy.AllowURLSchemes("data")
        // ...
    })
}

While the Markdown renderer rewrites relative links (mitigating standard Markdown [link](data:...) attacks), Gogs supports Raw HTML input. Raw HTML anchor tags bypass the Markdown parser's link rewriting and are processed directly by the sanitizer. Since the sanitizer is configured to allow data: URIs, payloads like <a href="data:text/html..."> are rendered as-is.

PoC

Create a file named exploit.md in a repository.

Add the following content (Raw HTML):

<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=">Click me for XSS</a>

Commit and push the file.
Navigate to the file in the Gogs web interface.
Click the "Click me for XSS" link.
Result: An alert box with "XSS" appears, executing the JavaScript payload.

Impact

This is a Stored XSS vulnerability. Any user who views the malicious comment and clicks the link will execute the attacker-supplied JavaScript in their browser context. This allows attackers to:

Steal authentication cookies and session tokens.
Perform arbitrary actions on behalf of the victim (e.g., modifying repositories, adding collaborators).
Redirect users to malicious sites.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26022

CVE-2026-26022:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.14.1	0.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Stored XSS in Gogs, caused by an overly permissive HTML sanitizer configuration. The analysis of the provided patch commit 441c64d7bd8893b2f4e48660a8be3a7472e14291 reveals the root cause.

The function NewSanitizer in internal/markup/sanitizer.go was responsible for setting up the sanitizer policy. The line sanitizer.policy.AllowURLSchemes("data") explicitly allowed any data: URI, which is insecure as it permits payloads like data:text/html;base64,... containing arbitrary JavaScript. This function is identified as vulnerable because it contains the faulty configuration.

The function Sanitize, in the same file, is the function that applies this flawed policy to user input. When a user submits content (e.g., in an issue comment), this function is called to clean the HTML. Because of the policy set by NewSanitizer, the Sanitize function would allow the malicious data: URI to pass through, leading to the XSS vulnerability when the content is rendered in a user's browser. Therefore, Sanitize is a key function that would be observed in a runtime profile during the exploitation of this vulnerability.

The patch rectifies this by removing the broad allowance of data: URIs and introducing a custom validation function, isSafeDataURI, which strictly limits data: URIs to specific, safe image MIME types, effectively preventing the XSS attack.

Vulnerable functions

NewSanitizer

internal/markup/sanitizer.go

This function initializes the HTML sanitizer policy. The vulnerability is caused by this function allowing the 'data' URL scheme without any restrictions, which enables attackers to inject malicious 'data:text/html' payloads. The patch removes this line and replaces it with a more restrictive policy.

Sanitize

internal/markup/sanitizer.go

This function applies the sanitizer policy to user-provided input. It uses the weak policy configured by `NewSanitizer`, thus processing and failing to properly sanitize malicious 'data:' URI payloads, leading to Stored XSS. While the function itself was not changed, it is the function that would appear in a runtime profile when the vulnerability is triggered, as it processes the malicious input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.